CodeVetter · Repo Unpack · Risk map
pact-foundation/pact-js
These findings are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include temporary HTTP listeners, request logging, caller-selected filesystem paths, and plugin executables installed outside the checkout. Failure handling deserves particular attention because ordinary state errors, experimental mismatch filtering, and cleanup exceptions follow different paths.
- State-handler exceptions are logged and answered with HTTP 200, unlike hook exceptions accumulated for final rejection; stateHandler.spec.ts explicitly asserts this successful HTTP response after a rejected setup callback.
- Hypothesis: debug/trace output can expose sensitive test data because request/response tracers include bodies and headers and verifier trace logging serializes core options, which may contain broker authentication fields. (inferred)
- Hypothesis: legacy MessageProviderPact may expose its callback dispatcher beyond loopback because setupProxyServer calls listen() without a host and registers a catch-all handler; the modern verifier explicitly defaults its bind host to 127.0.0.1. (inferred)
- Filesystem/process boundaries are caller-sensitive: binaryFile reads the supplied path without repo-root restriction, pact output uses opts.dir, and root pretest downloads a CLI into ~/.pact/bin then executes it to install MATT; the inspected downloader contains no checksum-validation step.
- Any nonempty PACT_EXPERIMENTAL_FEATURE_ALLOW_MISSING_REQUESTS value activates filtering that removes plugin mismatch objects and request-mismatch entries; HTTP execution rejects native failure only when filtered errors remain, so this flag materially changes validation.
- Hypothesis: native mismatch inspection or pact-write exceptions can bypass remaining HTTP cleanup because these calls sit outside the callback try/catch and cleanup writes before stopping servers/plugins, without a finally guard. (inferred)
- The public V4UnconfiguredInteraction interface advertises withCompleteRequest, but UnconfiguredInteraction.withCompleteRequest immediately throws an unimplemented error.
- Request.send creates an HTTPS agent with rejectUnauthorized=false and maxBodyLength=Infinity for caller-provided URLs; this differs from Verifier's default validateSSL=true, so the helper cannot be assumed to inherit verifier TLS behavior.